Securecodingexample is a project mainly written in PHP, it's free.

A badly coded Drupal module used as an example of insecure coding